Claude Code v2.1.309 fixes macOS/Linux sandbox escapes, MCP config writes, and session isolation issues

Anthropic released Claude Code v2.1.309 with more than 30 fixes focused on sandbox hardening, permission checks, and session isolation. The update addresses sandbox escapes on macOS and Linux where shell startup files could execute outside the sandbox before each command, a failure of the macOS sandbox’s denyWrite glob patterns to apply at symlinked paths, and sandboxed commands or auto-accepted edits being able to modify the MCP config file passed with --mcp-config.

Worktree-isolated sessions had flaws where they accepted certain locale-prefixed commands in zsh and arithmetic commands that the isolation guard should have refused. The release also fixes repeated session compaction when reading very large nested CLAUDE.md files, and ensures that oversized /feedback reports are resent without the transcript instead of failing outright.

Permission checks were corrected for PowerShell on Windows, including fixes for PreToolUse and PermissionRequest hooks that previously failed open when Git for Windows was not installed. Model aliases in mods’ turn.step hooks now resolve correctly, preventing model errors when aliases like haiku are used.

Session isolation was improved for worktrees and branch checkouts created by Claude Code so they ignore git replace refs, aligning with the behavior of other git operations in the agent. The claude remote-control status line no longer shows HEAD as the branch for folders outside a git repository, and split-pane agent teammates now inherit tool deny and --tools rules from the leader’s command line.

Additional fixes include preventing unrelated GitHub user mentions in PRs and issues, correcting the "Waiting for API response" hint flickering behind gateways, and ensuring fine-grained tool streaming works on Amazon Bedrock when ANTHROPIC_BEDROCK_BASE_URL is set to the default endpoint.